Resized Lion Created HFS+ Partition in Snow Leopard

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
wondering1
Posts: 1
Joined: 18 May 2012, 03:35

Resized Lion Created HFS+ Partition in Snow Leopard

#1 Post by wondering1 »

2TB external USB drive had been formatted GUID in Lion with a bootable Lion partition of 100GB and the rest of the 2TB was a Time Machine backup (containing many symbolic links making data recovery methods questionable at best).

In Lion, the bootable partition was reduced in size. The remaining space was turned into "free space". At this point, the Time Machine backup partition was resized to take advantage of the extra free space.

I suspect that the "free space" may have been created in Snow Leopard mistakenly instead of in Lion. Regardless of which OS was employed to create the free space, the Time Machine backup partition was damaged and simply named disk1s4.

What steps might I take from the below log to fix the partition?

"Untitled 1" below is Bootable and still mounts/boots successfully.
"Recovery HD" below is the Lion Recovery partition and still mounts/boots successfully.
"Untitled 2" below is the missing partition formerly known as the Time Machine backup.

Untitled 2 was HFS+ Journaled when it was not damaged.

Thu May 17 13:17:28 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 11.4.0 (Darwin Kernel Version 11.4.0: Mon Apr 9 19:32:15 PDT 2012; root:xnu-1699.2
Compiler: GCC 4.0
Compilation date: 2012-05-08T10:52:24
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
User is not root!
Hard disk list
Disk /dev/disk1 - 2000 GB / 1863 GiB - CHS 3907024896 1 1 (RO), sector size=512
Disk /dev/disk2 - 1499 GB / 1396 GiB - CHS 2928904192 1 1 (RO), sector size=512
Disk /dev/rdisk1 - 2000 GB / 1863 GiB - CHS 3907024896 1 1 (RO), sector size=512
Disk /dev/rdisk2 - 1499 GB / 1396 GiB - CHS 2928904192 1 1 (RO), sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk1 - 2000 GB / 1863 GiB (RO)
Partition table type: EFI GPT

Analyse Disk /dev/rdisk1 - 2000 GB / 1863 GiB - CHS 3907024896 1 1 (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907024895 (expected 3907024895)
hdr_lba_start=34
hdr_lba_end=3907024862
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
4 P Mac HFS 65773976 3906762711 3840988736 [Untitled 2]
Current partition structure:
1 P EFI System 40 409639 409600 [EFI System Partition]
2 P Mac HFS 409640 64504431 64094792 [Untitled 1]
3 P Mac Boot 64504432 65773975 1269544 [Recovery HD]
No HFS or HFS+ structure
4 P Mac HFS 65773976 3906762711 3840988736 [Untitled 2]
4 P Mac HFS 65773976 3906762711 3840988736 [Untitled 2]

search_part()
Disk /dev/rdisk1 - 2000 GB / 1863 GiB - CHS 3907024896 1 1 (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
EFI System 40 409639 409600 [EFI]
FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 64094792
Mac HFS 409640 64504431 64094792
HFS+ blocksize=4096, 32 GB / 30 GiB

HFS+ magic value at 64504432/0/1
part_size 1269544
Mac HFS 64504432 65773975 1269544
HFS+ blocksize=4096, 650 MB / 619 MiB
SIGHUP detected! TestDisk has been killed.



Thank you very much!

Locked